It ended up being radware, which is a bot manager type deal. If anyone ever runs into this, the key is to do an OPTIONS request from outside the network. I did that in POSTMAN and then the radware response page came up. You should normally see 404 with an OPTIONS request, since there's no endpoint specifically assigned to that method usually. Check that your firewall allows OPTIONS requests in this circumstance.
2
Answers
It ended up being radware, which is a bot manager type deal. If anyone ever runs into this, the key is to do an OPTIONS request from outside the network. I did that in POSTMAN and then the radware response page came up. You should normally see 404 with an OPTIONS request, since there's no endpoint specifically assigned to that method usually. Check that your firewall allows OPTIONS requests in this circumstance.
The Origin header is set by the browser, so this is not something ‘Azure’ can strip.
The header will not be set if the origin matches the URL you’re opening.